An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/6855227f-1237-47b8-8d37-29aad7ddec3a | Exploit Third Party Advisory |
Configurations
History
29 Jul 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://huntr.com/bounties/6855227f-1237-47b8-8d37-29aad7ddec3a - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:* | |
| First Time |
Openwebui
Openwebui open Webui |
|
| CWE | CWE-639 |
09 Oct 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-09 20:15
Updated : 2025-07-29 18:16
NVD link : CVE-2024-7041
Mitre link : CVE-2024-7041
JSON object : View
Products Affected
openwebui
- open_webui
CWE
CWE-639
Authorization Bypass Through User-Controlled Key